Arctic Wolf details 400 incidents where default Teams external chat became remote access

Microsoft Teams enables external access by default, so people in other Microsoft 365 tenants can reach employees by chat or call as long as both organisations allow it. Arctic Wolf has documented more than 400 incidents in which attackers abused that default setting to impersonate IT support and end up with remote control of the victim's machine — in under 15 minutes from the first reply.

The research was published on 26 October 2026, according to a dev.to write-up of the findings. The attackers reached multiple victims in quick succession, something the researchers interpret as a sign of automation. Arctic Wolf did not name the groups involved, but noted that ransomware crews including Black Basta have previously used external Teams chat as a way in.

A tenant as a disguise

Between 30 and 40 percent of the cases relied on default onmicrosoft.com tenant domains, which anyone can register in minutes without verification. The attackers typically built a tenant name around a word such as "support", "IT", "admin" or "helpdesk", sometimes adding "365", and combined it with an ordinary first name so the sender appeared as something like "IT Service Desk - Liam". In a few cases the tenant name included a real company's name, which makes the recipient's judgement harder: the external tag is visible, but the name looks familiar.

Mail noise sets the trap

In a significant share of the incidents, attackers first buried the victim's inbox under hundreds of subscription and newsletter confirmation messages within minutes. The Teams message followed shortly after, offering to sort out the noise — manufacturing a problem the attacker could then offer to fix.

From conversation to control

Most intrusions moved to hands-on-keyboard access via remote monitoring and management (RMM) software, most often Quick Assist, a Windows built-in that requires no installation. When attackers wanted to stay beyond the first session, they moved on to commercial products like AnyDesk or ScreenConnect. From there, Arctic Wolf observed a PowerShell payload and lateral movement, in some cases progressing toward ransomware deployment. In several incidents the victim was talked through running a PowerShell command and launching a downloaded file.

That 15-minute figure does not capture the full intrusion: it is the time from the victim responding to the message to the payload running. Any defence that depends on a user stopping to think has to operate inside that window, on a channel that gives the user no obvious reason for suspicion.

The recommended controls

Arctic Wolf's recommendations target each failure point in turn. In the Teams admin center, under Users and External access, restricting chat to explicitly named partner domains closes the route itself. Blocking conversations with unmanaged and consumer Teams accounts, switching off the option that lets unmanaged users initiate contact, and refusing federation with trial-only tenants cuts off the lowest-cost infrastructure available to attackers. Granting the security team permission to manage blocked domains means responders can intervene while an incident is unfolding rather than afterwards.

On execution, limiting Quick Assist to approved IT roles, and blocking or removing unsanctioned RMM tools, takes away the software the attacker persuades the user to run. Arctic Wolf presents this as the safeguard that still holds when awareness training fails, because it does not rely on the user seeing through the pretext. On detection, Microsoft's end-user reporting in Teams allows an employee to report a suspicious message or external user in two clicks, which matters most at first contact, when there is not yet a payload for tooling to catch.

The "External" label only signals that the sender sits outside the tenant. It cannot confirm whether the sender is genuinely from IT, since the attacker controls both the tenant name and the display name. Coaching staff on how legitimate IT support actually makes contact, and on which domain a message originates from, closes part of that gap — but not all of it, which is why the RMM restrictions come first.

Why it matters

Four hundred incidents within a single vendor's customer base, marked by uniform technique and little time between contact and execution, point to a coordinated campaign rather than isolated nuisance — and every intrusion began with a message Teams was built to deliver. For Microsoft 365 tenants, the lesson is to treat chat as an ingress path: the effective defences are configuration changes to external access and RMM tooling, not reliance on users making the right call inside a 15-minute window.